Warning

[xerox]

PLease dont think i am trying to start anythingg, but i have run into a problem here when i downloaded some videos. I usually download multiple vids at one time, yesterday i had about 8 different ones going, i do know that some of the vids were not from Rapid Share. Anyways one of the vids i downloaded which i have now deleted all of them put 3 different thing on my computer. one called Dot1XCFg, which everytime i try to delete it, my comp locks up, spybot has detected this and it says error when it tries to remove it.

2nd is a program call "wbun" have no idea what it is, but when i go through the registry to remove it it says cannot delete.

3rd is called "CMD network monitor friend" this as well give me an error when i try to delete.

I just want people to know, i am sorry that i cannot pin point where it came from.

If anyone has any ideas please let me know.

[Spytrx]

Surely you should know best what you were downloading at the time? That would narrow it down dramatically and help us tell you if any of us has any similar problems - this is just starting a blind goose chase and a wild panic otherwise...

[Ntense]

Naw, he might not have noticed a trojan downloading it's 'friends' in the background. I would have, but I'm *special* and very situationally-aware.

However, without a freaking clue which videos you downloaded, this is an utter waste of a post. Oh, are we supposed to shut down the entire board 'cos you've infected yourself??? Gimme a break... give us a list of what you downloaded so we can determine IF you got it from a post here, or STFU. It's easily possible that you got the infection several days ago, and just noticed it now.

TRY getting the latest version of AVG here: http://anonym.to/?http://free.grisof.../frt/0?prd=aff
and if you're REALLY LUCKY it may be able to clean you up. Probably not, but what the hell. Most of these trojans install something like a proxy server in your system which will make it impossible to download any antivirus or anti-spyware programs, but it never hurts to try.

There are a bunch of new trojans out there that masquerade as VIDEO CODECS on websites offering porn videos. If you've been to one of them in the last week, then THAT is probably where the initial infection came from. The 'fat chicks' post here is a great example of that type of trojan. Another is the entire ISCOOLVIDEO domain.

DO NOT STAY ONLINE WHILE YOU WIPE YOUR ASS. UNPLUG YOUR NETWORK CONNECTION UNTIL YOU SHOW THAT YOU ARE CLEAN. YOU ARE COMPROMISED, AND SOME LITTLE PRICK HAS ALREADY STOLEN YOUR PASSWORDS. YOU WILL BE INFECTING YOUR FRIENDS WITH EMAIL MESSAGES.

[Ntense]

Here's one of the better sites for malware & virus removal:

http://anonym.to/?http://wiki.castle...:_Introduction

coming from the 'Malware Removal' link at castlecops.com. It's pretty much a step-by-step guide to clean your system, *if* you can get there. I've been a member there for a few years, and they're good folks.

[APRIL MORN.]

THIS IS A LONG SHOT, DID YOU TRY A SYSTEM RESTORE; SOMETIMES, IT CAN HELP-------GOOD LUCK-------------

[Renegade]

Originally Posted by APRIL MORN.

THIS IS A LONG SHOT, DID YOU TRY A SYSTEM RESTORE; SOMETIMES, IT CAN HELP-------GOOD LUCK-------------

Following up on the comment above, you should remove the "restore points" that might have been set when your system was infected. It's possible to reinfect your system by choosing those restore points at a later date.


Also "Spyware Doctor" has a free version that is very good at picking up malware that is missed by AVG. I use both along with Windows Defender (which I've never found very useful) and Zone Alarm for a good firewall.

[Ntense]

Folks, have a little common sense.

If you can't say >THIS POST<, then you probably don't really have the foggiest notion WHERE you got infected. I've cleaned up around 150 computers myself, and the initial infection was one to three weeks *before* the person actually noticed that something was wrong. That's why I trounced Xerox earlier. There's no telling where the infection came from, and running around saying 'The sky is falling!' does no one any good.

In all likelihood, (his?) trojan came from some other site. I jump on anything that looks suspicious, as do the Mods here. For your safety, don't ever click on a link from someone with only 1 or 2 posts. Again, more common sense. We *do* get a fair number of spammers and hoaxers here at RapeBoard.

Just in the last 2 weeks, a few of my Google hits on innocent searches ended up with a redirect to a site that wanted me to install their 'video codec' or 'required ActiveX control'. I looked inside all three files, and submitted them to AVG after determining that they were undoubtedly unknown variants of current trojans. In all three cases, AVG agreed and they're detecting them now. God only knows how many thousand people got infected by those three files. There's always a one to five week 'window of opportunity' on any new trojan before all of the major antivirus programs catch up. Trend Micro is one of the best, but ANYTHING is better than nothing. If you're running without an antivirus program that's updated frequently and you don't have a software-based firewall, then you're ripe to get hit. The worthless 'firewall' that's included with XP is a waste of time. It never stopped anything.

(as the other post got deleted)
IF YOU HIT A WEBSITE THAT YOU CAN'T BACK OUT OF, do this:
CTRL-ALT-DEL and open up the [Task Manager] then hit the Applications tab and shut down your browser. DO NOT HIT THE YES BUTTON to get out of the freaking endless loop of error messages on the web page. If you were using a browser that returns you to the last page(s) you had open, then unplug your internet connection before launching your browser the next time. If you use Firefox, start it with the (Safe Mode) link. Some shells for IE (like Slimbrowser) don't offer this option, so you want the page to die and then clear the cache and close that window or tab.

Sadly, the 'blacklist' submittal form at Google hasn't been working right for the last few weeks, so they have a bunch of dangerous URLs in their search results. Watch your ass, ESPECIALLY if you're searching for porn! I got three infected files on non-porn searches... do the math.

Yeah, Spyware Doctor is a pretty good program... I've used it myself to clean off a friend's computer. Also good is the comment about avoiding any restore point that was set after the (guesstimated) date of infection. I'd delete any of the PREFETCH links added after that date as well, but you have to know what you're doing or you'll just slow Windows down (most of you shouldn't try this at home.) I wouldn't bother with the Windows Defender. Before MS bought them it was called 'Giant Anti-Spyware', and there little chance that the programming wizards at Microsoft improved it beyond the name (oozing sarcasm).

Nearly all of the trojans are stupid: they don't change the date, so you can see what's going on if you use the DETAILS view in Windows Explorer, then sort by MODIFIED. Be very careful what you delete, as the system changes timestamps pretty regularly on required files. If you delete the wrong thing, you'll completely fuck up Windows. Hell, the way some of the trojans hook into the system, just deleting THEM without first removing their hooks will kill Windows. A 'safe mode' F8 reboot is your friend...

The programs and procedures at CastleCops have worked for a bunch of people I know. I've been a member there for a very long time...

[leopolis]

[quote=Ntense;115928]Folks, have a little common sense.

I absolutely agree with Ntense. I guess that was what cause you such a damage. As Ntense highlights those viruses are just moving around sites so just follow what is said in Ntense message.

Good luck